Glens Falls Hospital sued for breach of patient record security

GLENS FALLS -- Glens Falls Hospital is being sued for the alleged unauthorized disclosure of 2,300 patients' medical records on the Internet.

The class-action lawsuit has been brought against the hospital and Virginia-based Portal Healthcare Solutions LLC, which provides physician transcription services, by the Albany law firm Dreyer Boyajian LLP. The lawsuit was filed Thursday in state Supreme Court in Saratoga County.

"The failure of the hospital to safeguard patient medical records that were made publicly available on the Internet for over four months constitutes a breach of patient trust that was entirely inexcusable and 100 percent preventable," Donald W. Boyajian, lead counsel for the plaintiffs, said in a statement.

The suit seeks monetary damages for the 2,300 affected patients for expenses related to identity theft and credit monitoring services. The suit also names Carpathia Hosting Inc., a server hosting company from which Portal leased space.

Hospital spokeswoman Darlene Raynsford said no financial information, home addresses or personal data, such as Social Security numbers, were compromised.

"It was purely diagnostic medical information from the physician," she said.

Raynsford said Portal left a server open from Nov. 2, 2012, until March 14, when the breach was discovered.

"We immediately acted to have Portal's server shut down and launched a thorough investigation," she said.

The firm's services have been terminated, and the hospital contacted all potentially affected patients with an April 3 letter. It's unknown if any records were actually breached.

Boyajian, however, said there has been a breach, but declined specifics.

"The magnitude of the damage is still being assessed, he said. "These things were out there for the world to see. People have an expectation that information will be kept private and confidential."

Raynsford said the hospital has made identify theft and credit protection services available to patients and is operating a call center to obtain information and have questions answered.

But Boyajian said, "The disclosure of private medical records on the Internet is obviously a very personal and disturbing matter. The area of the law is still developing. My clients want to make sure that this problem is fully addressed and never happens to anyone else."

He declined to comment about the amount of monetary damages being sought. Money would be for people to hire an outside firm to conduct identity theft monitoring to make sure records and information have not been used for malicious purposes.

Boyajian said instances like this are growing; as more and more information is kept electronically. His firm is now awaiting the hospital's response before deciding on the next course of action.

Raynsford said hospital lawyers are reviewing the case. It's too early to tell how the case will be resolved, she said.